Spring Framework Improper Path Limitation Vulnerability in Script View Templates

A vulnerability exists in Spring Framework versions 5.3.0 through 5.3.46, 6.1.0 through 6.1.25, 6.2.0 through 6.2.16, and 7.0.0 through 7.0.5. When Java scripting engines like JRuby or Jython are enabled, template views in Spring MVC and Spring WebFlux applications can inadvertently expose content from files located outside the designated script template view directories. This issue arises when the application has a mapping for '/**' that triggers view rendering without an explicitly specified view name.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of file contents from outside the allowed script template view locations.

Remediation

Users should upgrade to Spring Framework 7.0.6, 6.2.17, 6.1.26 (commercial), or 5.3.47 (commercial).